checkmarx/checkmarx-cve-2025-30066-detection-toolScans GitHub workflows and logs for indicators of CVE-2025-30066, detecting malicious actions and exposed secrets using Checkmarx 2ms integration.
These are tools for scanning your GitHub workflows and logs for potential malicious actions associated with CVE-2025-30066. It checks for a set of known risky GitHub Actions and a suspicious code snippet embedded in workflow files. As well for secrets that ended up being exposed to logs due to CVE-2025-30066.
The script looks for the following in your workflow files:
GitHub Actions:
reviewdog/action-setup
reviewdog/action-shellcheck
reviewdog/action-composite-template
reviewdog/action-staticcheck
reviewdog/action-ast-grep
reviewdog/action-typos
tj-actions/changed-files
tj-actions/eslint-changed-files
Malicious Code Snippet:
A base64-encoded snippet:
IyEvdXNyL2Jpbi9lbnYgcHl0aG9uMwoKIyBiYXNlZCBvbiBodHRwczovL2RhdmlkZWJvdmUuY29tL2Jsb2cvP3A9MTY
You can run the scan in one of three modes:
Organization Scan: Use the --org flag to scan all repositories within an organization.
Repository Scan: Use the --repo flag to scan a specific repository (format: owner/repo or a full GitHub URL).
User Scan: Use the --user flag to scan all repositories for a specific user.
To access repository content, you'll need a GitHub Personal Access Token (PAT) provided via the --token flag:
Organization Scans: The PAT must include the repo and read:org scopes.
User/Repository Scans: The PAT should have repo (for private repos) or public_repo (for public repos).
To scan all repositories in an organization called myorg with the default keywords, run:
python CxGithubActionsScan.py --org myorg --token YOUR_GITHUB_PAT
CxGithub2msScan is a Python tool that downloads GitHub Actions workflow run logs for a specified repository and scans them using the Checkmarx 2ms tool to detect secrets or leaked keys.
To access repository content, you'll need a GitHub Personal Access Token (PAT) provided via the --token flag:
Run the tool from the command line with the required arguments. For example:
python CxGithub2msScan.py --owner your_org --repo your_repo --days 7 --token YOUR_GITHUB_TOKEN --output logs